{
  "Event": {
    "analysis": "2",
    "date": "2016-08-18",
    "extends_uuid": "",
    "info": "OSINT Snakes in the Satellites: On-going Turla Infrastructure by PassiveTotal",
    "publish_timestamp": "1498162333",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1498162260",
    "uuid": "57b58ade-2da0-4f50-98b3-4846950d210f",
    "Orgc": {
      "name": "CthulhuSPRL.be",
      "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#12e200",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"Turla Group\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515381",
        "to_ids": false,
        "type": "link",
        "uuid": "57b58af5-e464-4247-8dd6-49bf950d210f",
        "value": "http://blog.passivetotal.org/snakes-in-the-satellites-on-going-turla-infrastructure/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515428",
        "to_ids": false,
        "type": "link",
        "uuid": "57b58b24-6fa0-4635-afae-4967950d210f",
        "value": "https://www.passivetotal.org/certificate/sha1/f415844680ed9118ea74e0c7712b35044f0cc20d"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515428",
        "to_ids": false,
        "type": "link",
        "uuid": "57b58b24-2e74-4f4a-bcca-4828950d210f",
        "value": "https://www.passivetotal.org/certificate/sha1/fccaea742ed154c9e512da0495a30d79a1b16afd"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515449",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b39-6908-4c93-a1a2-4ede950d210f",
        "value": "78.138.25.24"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515449",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b39-446c-44aa-ac48-4e53950d210f",
        "value": "83.229.103.133"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515449",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b39-b48c-421a-a961-4925950d210f",
        "value": "78.138.25.29"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515450",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b3a-97ec-42ba-aa33-41ea950d210f",
        "value": "83.229.62.179"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515450",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b3a-2058-4664-800c-41f4950d210f",
        "value": "169.255.100.152"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515450",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b3a-6114-4cc2-b78c-4c3e950d210f",
        "value": "83.229.75.141"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515450",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b3a-c77c-467c-8f1e-443e950d210f",
        "value": "78.138.25.19"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515450",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b3a-d778-4887-ac6b-4d18950d210f",
        "value": "169.255.102.246"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515451",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b3b-bf38-436e-91c1-412e950d210f",
        "value": "62.56.130.13"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515451",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b3b-ed54-42b4-8c7f-45aa950d210f",
        "value": "81.199.160.11"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515451",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b3b-9dfc-4969-ab37-48fd950d210f",
        "value": "169.255.101.235"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515451",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b3b-4d18-45b3-a328-4523950d210f",
        "value": "169.255.102.240"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515451",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b3b-b9b4-4bce-bfc9-436d950d210f",
        "value": "78.138.3.182"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515452",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b3c-c184-4be0-8a4d-4122950d210f",
        "value": "169.255.102.110"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515452",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b3c-9728-4b19-a732-4f43950d210f",
        "value": "169.255.100.122"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515452",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b3c-d080-46a2-856f-4e22950d210f",
        "value": "169.255.100.237"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515452",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b3c-a79c-47ad-ba73-4be3950d210f",
        "value": "169.255.101.65"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515452",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b3c-706c-4384-bd4c-42e0950d210f",
        "value": "83.229.103.140"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515453",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b3d-b06c-412a-b18b-4051950d210f",
        "value": "83.229.62.210"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515453",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b3d-4450-44af-b0ca-4716950d210f",
        "value": "83.229.62.206"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515453",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b3d-803c-4865-9cd6-4f25950d210f",
        "value": "83.229.62.249"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515453",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b3d-21c4-44c0-a947-42b7950d210f",
        "value": "81.199.118.4"
      },
      {
        "category": "Attribution",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515471",
        "to_ids": true,
        "type": "x509-fingerprint-sha1",
        "uuid": "57b58b4f-b4b4-41c2-88dc-4008950d210f",
        "value": "fccaea742ed154c9e512da0495a30d79a1b16afd"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515486",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b5e-e504-4074-9821-4e70950d210f",
        "value": "209.239.79.29"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515487",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b5f-1704-4cb0-b442-4f7b950d210f",
        "value": "169.255.100.222"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515487",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b5f-bce0-45dc-b0b6-496f950d210f",
        "value": "209.239.79.69"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515487",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b5f-493c-4c96-b4eb-4559950d210f",
        "value": "82.146.174.240"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515487",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b5f-6ec4-47f3-8ea7-4ff0950d210f",
        "value": "82.146.166.61"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515488",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b60-0c68-4c3f-8f92-45a0950d210f",
        "value": "193.220.55.6"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515488",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b60-d500-4bfd-9a46-405d950d210f",
        "value": "83.229.62.212"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515488",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b60-30a8-47d3-ada9-4ed6950d210f",
        "value": "113.208.81.33"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515488",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b60-6ac4-4254-ae01-4cf0950d210f",
        "value": "82.146.174.40"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515488",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b60-1f54-46de-ba85-44f7950d210f",
        "value": "82.146.175.52"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515489",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b61-b30c-4466-89c5-44c7950d210f",
        "value": "113.208.81.48"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515489",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b61-a974-4b66-afc7-4e00950d210f",
        "value": "77.246.76.19"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515489",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b61-1570-455b-b88a-4f20950d210f",
        "value": "209.239.79.121"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515489",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b61-b22c-459b-8c7e-4fa4950d210f",
        "value": "209.239.79.125"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515490",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b62-d4e4-4611-8313-4535950d210f",
        "value": "217.194.150.31"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515490",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b62-8e10-43cf-a6cf-47a8950d210f",
        "value": "82.146.166.58"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515490",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b62-2750-4e56-9f2d-4e04950d210f",
        "value": "217.194.149.111"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515490",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b62-3528-4e44-8459-4455950d210f",
        "value": "193.220.30.72"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515491",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b63-1988-4343-a4fa-4852950d210f",
        "value": "77.246.78.224"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515491",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b63-a5b0-4e20-b51d-4405950d210f",
        "value": "92.62.221.47"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515491",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b63-ad58-4704-8807-4049950d210f",
        "value": "113.208.81.55"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515491",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b63-9928-4c5a-aa35-439b950d210f",
        "value": "31.209.133.125"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515491",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b63-57dc-4d6e-a284-458c950d210f",
        "value": "217.8.36.239"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515492",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b64-3b7c-48bf-ba42-4d2d950d210f",
        "value": "82.146.175.48"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515492",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b64-1d04-43bf-b310-4618950d210f",
        "value": "82.146.175.69"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515492",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b64-6620-4096-9835-493c950d210f",
        "value": "82.146.175.29"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515492",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b64-df98-4d09-adbb-462c950d210f",
        "value": "41.203.79.74"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515492",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b64-1f5c-4771-9a2a-4d64950d210f",
        "value": "77.73.187.223"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515493",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57b58b65-51f4-4bc7-ae9a-40ab950d210f",
        "value": "217.194.150.22"
      },
      {
        "category": "Attribution",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515513",
        "to_ids": true,
        "type": "x509-fingerprint-sha1",
        "uuid": "57b58b79-5578-4825-a05c-4377950d210f",
        "value": "f415844680ed9118ea74e0c7712b35044f0cc20d"
      },
      {
        "category": "Attribution",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471515528",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "57b58b88-c9f8-482e-bcfc-42f4950d210f",
        "value": "Turla"
      }
    ]
  }
}